PT-2007-5926 · Cisco · Cisco Asa

Lisa Sittler

·

Published

2007-09-10

·

Updated

2025-01-17

·

CVE-2007-4786

CVSS v2.0

4.3

Medium

VectorAV:A/AC:H/Au:S/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance (ASA) versions 7.0 through 7.0.7.1 Cisco Adaptive Security Appliance (ASA) versions 7.1 through 7.1.2.61 Cisco Adaptive Security Appliance (ASA) versions 7.2 through 7.2.2.34 Cisco Adaptive Security Appliance (ASA) versions 8.0 through 8.0.2.11
Description: The issue allows context-dependent attackers to obtain sensitive information when AAA is enabled. This occurs because the system composes messages from the "test aaa" command with cleartext passwords and sends them over the network to a remote syslog server or places them in a local logging buffer.
Recommendations: For versions 7.0 through 7.0.7.1, update to version 7.0.7.1 or later to resolve the issue. For versions 7.1 through 7.1.2.61, update to version 7.1.2.61 or later to resolve the issue. For versions 7.2 through 7.2.2.34, update to version 7.2.2.34 or later to resolve the issue. For versions 8.0 through 8.0.2.11, update to version 8.0.2.11 or later to resolve the issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2007-4786

Affected Products

Cisco Asa